authz: viewable_environments defined only in the data document is treated as undefined (fails open) #6571

Summary

Since #6567, the Rego engine decides whether a policy defines the optional viewable_environments scope by looking for a rule with that name in the parsed .rego module (internal/server/authz/engine/rego/engine.go, updatePolicy).

The query x = data.flipt.authz.v2.viewable_environments can also be answered by a data document at flipt.authz.v2.viewable_environments in the authz data source, with no rule in the policy.

Behavior

For the data-only setup, ListEnvironments now returns every environment. It fails open.

viewable_namespaces is not affected: it is a function, so it can't come from data.

Possible fixes

• Treat the scope as defined when either the module has the rule or the store has a document at that path. The store can change on data reload, so check it at eval time or when updateData runs.
• Or document that viewable_environments must be defined as a rule in the policy, and warn when a data document exists at that path without one.

Tests

Add an engine test that sets viewable_environments only through the data source and checks that the returned scope is filtered, not nil.